I suggest you run sudo bash on all of these so you're the root user.
- Download tailscale and put the files in
/config/. Find the latest stable or unstable version for your EdgeRouter's processor (ex. ER4 ismipsand ERX ismipself)
sudo bash # if you havent already
curl https://pkgs.tailscale.com/unstable/tailscale_XYZ_mips.tgz | tar xvz -C /tmp
cp /tmp/tailscale_*/* /tmp/tailscale_*/systemd/* /config/- Create the
/config/scripts/firstboot.d/tailscale.shfile which gets run once every system upgrade. Reminder that/configsurvives upgrades. Don't forget to set the execute flag on the script insidefirstboot.d
cat << EOF > /config/scripts/firstboot.d/tailscale.sh
#!/bin/sh
ln -s /config/tailscaled.service /lib/systemd/system/tailscaled.service
ln -s /config/tailscaled.defaults /etc/default/tailscaled
ln -s /config/tailscale /usr/bin/tailscale
ln -s /config/tailscaled /usr/sbin/tailscaled
mkdir -p /var/lib/tailscale/
touch /config/auth/tailscaled.state
chmod 0400 /config/auth/tailscaled.state
ln -s /config/auth/tailscaled.state /var/lib/tailscale/tailscaled.state
systemctl enable --now tailscaled
EOF
chmod +x /config/scripts/firstboot.d/tailscale.sh- And run this script now to get things going (or manually run the commands if you'd like), and then run
tailscale upto login. Feel free to use other parameters liketailscale up --advertise-routes=10.0.1.0/24
/config/scripts/firstboot.d/tailscale.sh
tailscale up- That's it, you're done! If you found this useful, i'd super appreciate if you could Star up top. Like everyone, I like Internet points too! :)
- Download the version you want into a folder like
/tmpand then copy the binaries over. Perhaps in future versions there may be more/less files or config changes, so make sure you take a look at what's now.
sudo bash # if you havent already
curl https://pkgs.tailscale.com/unstable/tailscale_XYZ_mips.tgz | tar xvz -C /tmp
systemctl disable --now tailscaled
cp /tmp/tailscale_*/{tailscale,tailscaled} /config/
systemctl enable --now tailscaled
- Stop the service if its still running
sudo bash # if you havent already
systemctl disable --now tailscaled- Delete all the files tailscale uses
rm /lib/systemd/system/tailscaled.service
rm /etc/default/tailscaled
rm /usr/bin/tailscale
rm /usr/sbin/tailscaled
rm -rf /var/lib/tailscale- Remove your configs and persistent files (this includes your
tailscaled.statewhich has your private key)
rm /config/tailscale*
rm /config/auth/tailscaled.state
rm /config/scripts/firstboot.d/tailscale.sh
ovizii, I managed to make it work on Unifi USG3&Pro and presume it should work on UDM/Pro as well. The issue with lg’s instructions above is that USG uses the old way of starting services and does not support systemctl. I spend few hours trying to make it work and start tailscaled as a service, but in the end, I gave up. Instead, I have modified the script to start tailscaled as a background process to open the tun and then initiate tailscale connection. Here is what you should do:
where 192.168.X.0/24 is the internal LAN network behind your USG, which you would like to be accessible by all other tailscale hosts (say you logon to tailscale using your phone or tablet and want to see all you computers, like NAS, hubs etc. from your local network). You can skip “--advertise-routes=192.168.X.0/24” option if you do not want to expose any internal networks, or you can add multiple subnets/vlans by separating them with commas.
This is all you need to do for a single USG, which will make sure that your USG opens persistent connection to your tailscale network, which survives provisions/reboots/upgrades.
If you have two sites managed by USG you can build taiscale/wireguard VPN tunnel between them, by installing tailscale on both USGs following the instructions above for each of the USGs, where the only difference being the internal networks that each USG is exposing, say USG1 exposes 192.168.X1.0/24, while USG2 exposes 192.168.X2.0/24, then you need to modify the last line in the script respectively. Next to it you need to add a static route in each of the USGs telling the rest of the hosts in the respective local networks how they can find hosts in the other network. To do so, for each of the USGs you need to logon in their respective Unifi controllers via the web interface, select the site where respective USG is sitting and go to routing & firewall section. There you need to add a new static route: say you at USG1 site, then you need to create new static route for 192.168.X2.0/24 network with a next hop being the tailscale IP address of USG1 (which you can see in tailscale admin console). You can do similar thing for USG2, where you add static route for 192.168.X1.0/24 network with next hop being the tailscale IP address of USG2. After your USGs get provision, both local networks should be able to see each other as if you have created automatic IPsec site-to-site VPN, with advantage being that the connection will be much faster and secure and that both USGs can reside on two different Unifi controllers.